CWE-663: Use of a Non-reentrant Function in a Concurrent Context Use of a Non-reentrant Function in a Concurrent Context
Weakness ID: 663 (Weakness Base) Status: Draft
Description
Description Summary
The software calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler ) may have an opportunity to call the same function or otherwise influence its state.
Time of Introduction
Architecture and Design
Implementation
Common Consequences
Scope Effect Integrity
Confidentiality
Other
Technical Impact: Modify application
data; Read application
data; Alter execution
logic
Observed Examples
Reference Description CVE-2001-1349 unsafe calls to library functions from signal
handler CVE-2004-2259 handler for SIGCHLD uses non-reentrant
functions
Potential Mitigations
Phase: Implementation
Use reentrant functions if available.
Phase: Implementation
Add synchronization to your non-reentrant function.
Phase: Implementation
In Java, use the ReentrantLock Class.
Relationships
References
Content History
Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated References, Potential_Mitigations,
Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships, References 2009-03-10 CWE Content Team MITRE Internal updated Related_Attack_Patterns 2010-09-27 CWE Content Team MITRE Internal updated Name, Observed_Examples, Potential_Mitigations,
References, Relationships 2010-12-13 CWE Content Team MITRE Internal updated Description, Name,
Relationships 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences Previous Entry Names Change Date Previous Entry
Name 2010-09-27 Use of a Non-reentrant
Function in an Unsynchronized Context 2010-12-13 Use of a Non-reentrant
Function in a Multithreaded Context
Description
